Establishing Data Stewardship Models ECAR Working Group Paper | December 18, 2015 ECAR working groups are where EDUCAUSE members come together to create solutions to today’s problems and provide insight into higher education IT’s tomorrow. Individuals at EDUCAUSE member institutions are invited to collaborate on projects that address core technology challenges and advance emerging technologies important to colleges and universities. More information can be found at the ECAR working groups website. Introduction In the current world of enterprise-wide systems, business intelligence, and metrics—as well as the security and privacy concerns that accompany them—administrative data are increasingly recognized as an institutional asset that, because of their strategic importance, need to be managed carefully and used appropriately. Data stewardship provides higher education institutions with a way to carry out this task in a coordinated fashion and to serve their students, faculty, and staff well. Just as physical assets should be managed effectively to provide the best learning and working environments for a campus, so too should the data available to the institution about its services, programs, operations, finances, and facilities be managed to improve understanding, increase efficiency and effectiveness, inform decisions, and support change. A data stewardship program speaks directly to the university about the responsibilities of data curation and access; it is the bedrock of any good data governance program.1 Although it may be possible to have data stewards and even a data stewardship program without data governance in place, true data governance cannot exist without data stewards. Indeed, the formation of data governance often begins with stewardship. This paper provides guidance on establishing a data stewardship program for administrative data. It clarifies the different types of data stewards and managers and their roles and responsibilities, where they reside in an organization, how they work with colleagues to ensure that the data are maintained, and what special skills or training are needed to meet both university responsibilities and best practices. Defining the Data Steward You can usually tell a data steward by the kinds of questions they might ask in a meeting, such as “Why are those data important to the institution?” or “How long do you think we should keep that record?” or “What can we do to improve the quality of that analysis?” All of these questions point to someone who is interested in the data environment and the processes that go into capturing, storing, processing, and maintaining the data that are the lifeblood of the university. One hallmark of a data steward is being the “go to” person with the “tribal knowledge” of how data are collected, maintained, and interpreted. As data stewardship programs mature, formalize, and achieve © 2015 EDUCAUSE. CC by-nc-nd. alignment with (or spawn) data governance programs, data stewards’ expertise is translated into documentation and business rules that facilitate transparency and allow authorized consumers greater self-service to use data as intended, congruent with the data steward’s oversight and guidance. Good data stewards share some common characteristics. For one, stewards listen to and understand issues related to the data processes and quality. They want to do what they can to improve everything that goes into the area of data management. They want to find solutions to improve the overall data landscape, and as such they are willing to guide individuals or groups in their pursuit of better data quality. They understand which resources can best assist with or provide answers to data issues and questions, and they are willing to direct anyone to those resources in the interest of data improvement. As they learn of or identify data-related issues, they look to find a resolution path, whether guided individually or through others. They also understand that not all data issues can be resolved by quick fixes. Sometimes systemic change is required, but a data steward believes that the long-term view of a better data landscape is worth the effort it takes to make the needed changes. The best data stewards possess the ability to see the “big picture” to assess the value of data and the relationships of the data to processes, to other data, and to decision making and outcomes. They also can be extremely detailed oriented, intimate with every data element and how terminology is used to represent the relevant concepts. Data stewardship is still fairly new as a broad concept in higher education, and the term data steward is used inconsistently from one institution to another. In addition, a data steward’s responsibilities may vary depending on institution size and type, as well as data maturity (e.g., whether data governance is in place or a formal stewardship program exists). For example, the term data steward may refer to an IT staff member who is responsible for maintaining control of access to data, to a staff member who updates particular data elements, to a department director who manages her staff’s use of the data, or even to a committee that approves new data values. In this paper we focus on what is essential to responsible data management in this definition of stewards: Data Stewards: Individuals who are responsible for promoting appropriate data use through planning, policy, and protocols at your institution. Data stewards provide university-level knowledge and understanding for a specific data area (e.g., student data, financial data, HR data, or alumni development data). Data stewards are responsible for data quality and data integrity, including consistent data definitions and their application throughout connected systems. They collaborate with other stewards to ensure that overlap areas (e.g., student employees and employees who are students) work across the board and that system updates are scheduled reasonably and tested appropriately. Data stewards work with security, privacy, and compliance officers to ensure that data are classified appropriately and that appropriate training is provided to users who will interact with data. Example stewards are the registrar and HR director. Data stewards’ responsibilities can be grouped into four main areas: operational oversight; data quality; privacy, security, and risk management; and policies and procedures. Operational Oversight: One hallmark of data stewards is their key role in overseeing the life cycle of a particular set of institutional data. Specifically, data stewards are responsible for defining and implementing policies and procedures for the day-to-day operational and administrative management of systems and data, including the intake, storage, processing, and transmittal of data to internal and external systems. To ensure compliance with data policies and procedures, stewards provide training and documentation for employees with data-entry and maintenance responsibilities. As part of the 2 oversight for institutional data, the data steward must be accountable to define and document data and terminology in a business glossary.2 This includes ensuring that each critical data element has a clear definition and is still being used—or retiring those that are not—and that adequate documentation is developed, maintained, and distributed appropriately. Often, operational oversight accompanies being a process owner; in cases where there are multiple process owners, a high degree of coordination is required to ensure that the processes are aligned with data policies and guidelines. Data Quality: Data stewards are ultimately responsible for establishing data-quality metrics and requirements, including defining the values, ranges, and parameters that are acceptable for each data element. Data stewards work with custodians to establish procedures for detection and correction of data-quality issues and collaborate with process owners to establish policies, procedures, and internal controls affecting the quality of data. In addition, data stewards engage in the ongoing and detailed evaluation of data quality, the identification of anomalies and discrepancies, and the contribution of expertise to understand the root cause and implement corrective measures. This requires tactical resolution of individual unit records such as invalid field values, duplicate person records, incorrectly merged person records, and incorrect identifiers and attributes. Privacy, Security, and Risk Management: Data stewards are responsible for overseeing privacy, security, and risk management pertaining to data. In one of the more challenging aspects of protecting the data, stewards must establish guidelines and protocols that govern the proliferation of data to ensure that privacy controls are enforced in downstream systems and processes. To be effective, the data steward must compile retention, archival, and disposal requirements and ensure compliance with institutional policy and regulations. Accordingly, the data steward will establish and implement data- curation practices to ensure that the life span of data is commensurate with requirements.3 However, data stewards must protect data while striking a balance between transparency and privacy. This requires establishing information security requirements, including data classification and identification.4 In addition, data stewards must be knowledgeable in regulatory and compliance requirements relevant to the data domain to evaluate risks to the confidentiality, integrity, or